Bump the python-packages group with 5 updates

[dependabot]

Bumps the python-packages group with 5 updates:

Package	From	To
starlette	0.46.1	0.46.2
typing-extensions	4.13.1	4.13.2
urllib3	2.3.0	2.4.0
uvicorn	0.34.0	0.34.1
watchfiles	1.0.4	1.0.5

Updates starlette from 0.46.1 to 0.46.2

Release notes

Sourced from starlette's releases.

Version 0.46.2

What's Changed

• Use correct index on backwards compatible logic in TemplateResponse by @​alex-oleshkevich in encode/starlette#2909
• Prevents reraising of exception from BaseHTTPMiddleware by @​ramannanda9 in encode/starlette#2911

New Contributors

• @​ahryniv made their first contribution in encode/starlette#2913
• @​ramannanda9 made their first contribution in encode/starlette#2911

Full Changelog: Kludex/starlette@0.46.1...0.46.2

Changelog

Sourced from starlette's changelog.

0.46.2 (April 13, 2025)

Fixed

• Prevents reraising of exception from BaseHttpMiddleware #2911
• Use correct index on backwards compatible logic in TemplateResponse #2909.

Commits

• 4a81176 Version 0.46.2 (#2921)
• 48f7cd7 Prevents reraising of exception from BaseHttpMiddleware (#2911)
• 5d98cd5 Include Python 3.14 to the pipeline (#2919)
• eb6cebb Bump the python-packages group with 6 updates (#2914)
• d278caf Fix link title for contextvars.ContextVar (#2913)
• bcdf0ad fix IndexError in TemplateResponse (#2909)
• c8a4692 Update note about anyio thread pool (#2895)
• aa8f6f0 docs: fix email on sponsorship page
• a8a4437 docs: fix Alex's github handle (#2901)
• See full diff in compare view

Updates typing-extensions from 4.13.1 to 4.13.2

Release notes

Sourced from typing-extensions's releases.

4.13.2

• Fix TypeError when taking the union of typing_extensions.TypeAliasType and a typing.TypeAliasType on Python 3.12 and 3.13. Patch by Joren Hammudoglu.
• Backport from CPython PR #132160 to avoid having user arguments shadowed in generated __new__ by @typing_extensions.deprecated. Patch by Victorien Plot.

Changelog

Sourced from typing-extensions's changelog.

Release 4.13.2 (April 10, 2025)

• Fix TypeError when taking the union of typing_extensions.TypeAliasType and a typing.TypeAliasType on Python 3.12 and 3.13. Patch by Joren Hammudoglu.
• Backport from CPython PR #132160 to avoid having user arguments shadowed in generated __new__ by @typing_extensions.deprecated. Patch by Victorien Plot.

Commits

• 4525e9d Prepare release 4.13.2 (#583)
• 88a0c20 Do not shadow user arguments in generated __new__ by @deprecated (#581)
• 281d7b0 Add 3rd party tests for litestar (#578)
• 8092c39 fix TypeAliasType union with typing.TypeAliasType (#575)
• See full diff in compare view

Updates urllib3 from 2.3.0 to 2.4.0

Release notes

Sourced from urllib3's releases.

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

• Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)
• Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)
• Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

• Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

• Switched to uv for installing development dependecies. (#3550)
• Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

Changelog

Sourced from urllib3's changelog.

2.4.0 (2025-04-10)

Features

• Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)
• Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)
• Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

• Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

• Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)
• Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

Commits

• a5ff7ac Release 2.4.0
• a135db2 Upgrade memray and coverage to fix macOS tests (#3589)
• 8f40e71 Upgrade the publishing action to get correct licensing info on PyPI (#3585)
• 3ff4e49 Add a link to the 2024 annual report (#3586)
• 75709c1 Set verify flags in create_urllib3_context (#3577)
• 5c8f82a Bump astral-sh/setup-uv from 5.3.0 to 5.4.1 (#3580)
• 42e90d8 Bump actions/setup-python from 5.4.0 to 5.5.0 (#3579)
• 3e8f2db Stop using Ubuntu 20.04 and 22.04 in CI (#3570)
• e29db82 Update exceptions to have more of their attributes pickled (#3572)
• f8a0c43 Add PyPy 3.11 to CI
• Additional commits viewable in compare view

Updates uvicorn from 0.34.0 to 0.34.1

Release notes

Sourced from uvicorn's releases.

Version 0.34.1

What's Changed

• Deprecate ServerState in the main module by @​Kludex in encode/uvicorn#2581

New Contributors

• @​RakhimovRamis made their first contribution in encode/uvicorn#2567
• @​carlwgeorge made their first contribution in encode/uvicorn#2590

Full Changelog: Kludex/uvicorn@0.34.0...0.34.1

Changelog

Sourced from uvicorn's changelog.

0.34.1 (April 13, 2025)

Deprecated

• Deprecate ServerState in the main module (#2581)

Commits

• 695820a Version 0.34.1 (#2612)
• 56c45db docs: add sponsorship banner (#2611)
• f2192cc docs: add section about Docker under Deployment (#2610)
• 7fb029d Bump the python-packages group with 8 updates (#2606)
• 4fdfec4 docs: mention discord instead of gitter (#2595)
• e5f3663 Speed up test suite with pytest-xdist (#2537)
• 2445e79 docs: improve settings page (#2594)
• 7abc199 Bump the python-packages group with 5 updates (#2588)
• 4e6786e Add sponsorship page (#2593)
• 8136fb6 Avoid test dependency on typing_extensions (#2590)
• Additional commits viewable in compare view

Updates watchfiles from 1.0.4 to 1.0.5

Release notes

Sourced from watchfiles's releases.

v1.0.5 2025-04-08

What's Changed

• Bump pyo3 from 0.23.3 to 0.24.1 by @​dependabot in samuelcolvin/watchfiles#333
• use uv publish --trusted-publishing, remove twine check by @​samuelcolvin in samuelcolvin/watchfiles#334
• uprev to 1.0.5 by @​samuelcolvin in samuelcolvin/watchfiles#335

Full Changelog: samuelcolvin/watchfiles@v1.0.4...v1.0.5

Commits

• 85997dd fix publishing
• 3a4c7e9 uprev to 1.0.5 (#335)
• 5be19ff use uv publish --trusted-publishing, remove twine check (#334)
• 188f5e9 Bump pyo3 from 0.23.3 to 0.24.1 (#333)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 85e00ed.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
typing-extensions	4.13.2	Null	Unknown License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense, Zlib, ZPL-2.1

OpenSSF Scorecard

Package	Version	Score	Details
pip/starlette	0.46.2	🟢 6	Details Check Score Reason Code-Review 🟢 5 Found 13/26 approved changesets -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 27 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ -1 no releases found Vulnerabilities 🟢 10 0 existing vulnerabilities detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/typing-extensions	4.13.2	🟢 6.6	Details Check Score Reason Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 23 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Vulnerabilities 🟢 3 7 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/urllib3	2.4.0	🟢 9.2	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 29 out of 29 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices 🟢 5 badge detected: Passing Code-Review 🟢 9 Found 23/24 approved changesets -- score normalized to 9 Contributors 🟢 10 project has 122 contributing companies or organizations Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Maintained 🟢 10 21 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases 🟢 8 4 out of the last 5 releases have a total of 4 signed artifacts. Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected
pip/uvicorn	0.34.1	🟢 6	Details Check Score Reason Maintained 🟢 10 11 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 2 Found 5/24 approved changesets -- score normalized to 2 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/watchfiles	1.0.5	🟢 4.3	Details Check Score Reason Code-Review 🟢 3 Found 8/26 approved changesets -- score normalized to 3 Maintained 🟢 5 4 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Vulnerabilities 🟢 7 3 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• poetry.lock